Judge lifts fare card hack gag order, punts on 1st Amendment

Judge George O'Toole ruled today that the MIT students accused of attempting …

In court today, Judge George O'Toole refused the Massachussetts Bay Transit Authority's request to impose an additional five-month gag order against five students the MBTA had accused of violating Computer Fraud and Abuse Act (CFAA). Prior to this point, the students had been subject to a 10-day gag order which prevented them from presenting a paper on the flaws within the MBTA's transit system at DEF CON earlier this month.

The Electronic Frontier Foundation (EFF) had argued that refusing the student's permission to speak constituted a violation of their First Amendment rights, but the judge chose not to address First Amendment concerns at all. Instead, O'Toole focused on whether or not the students had violated the CFAA, and found that they had not. First, the student's presentation (had it been given), did not constitute a computer-to-computer transmission. Second, the MBTA presented no evidence that the students had caused at least $5,000 worth of damage in the course of their research.

Judge O'Toole's decision to lift the gag order against the students does not constitute a dismissal of the case, though the MBTA has yet to announce whether or not it will appeal O'Toole's ruling. After reviewing a confidential 30-page report on the MIT group's findings, the Transit Authority has confirmed that they did not, in fact, break the paper Charlie Card payment system, but had only uncovered a theoretical method for breaking the Charlie Card. The MBTA maintains that it had no interest in violating the young security researchers' rights, but only wished to prevent information on how to hack the transit system from escaping into the wild. The students have maintained that they had no plans to ever disseminate enough of their findings to allow for such hacks to take place, and that the MBTA was aware of this from the beginning.

With the gag order lifted, the group could theoretically present its findings in another forum, but it wouldn't be surprising if the MBTA made the non-occurence of such an event part of any settlement the transit authority might offer. Regardless, the students from MIT have no plans to leak the 30-page confidential document they turned over to the MBTA. As Zack Anderson, one of the students, told the Boston Globe "It wasn't to enable others to get a free fare or cause any sort of havoc," Anderson said, "It was really to show how major the issues are in this system, which also might resonate in many other systems around the world."

The issues Anderson and his cohorts raised obviously resonated with the MBTA—just not in quite the way the students might have hoped.